| *** yamamoto has quit IRC | 00:42 | |
| openstackgerrit | Michael Johnson proposed openstack/octavia-tempest-plugin master: Add a TLS scenario using Barbican https://review.openstack.org/628075 | 00:46 |
|---|---|---|
| bzhao__ | https://www.irccloud.com/pastebin/uurRYByR/ | 00:58 |
| *** yamamoto has joined #openstack-lbaas | 01:01 | |
| bzhao__ | johnsom: Also, I create the test certs in octavia-tempest-plugin repo directory by creating a new tmp dir..And create them using a shell script. Then upload the necessary certs into KMS(barbican), using the other part for test locally or upload to the member vm to start https server. | 01:01 |
| johnsom | bzhao__ Hi, sorry I missed these messages. I have also started on Barbican/TLS tests. I have the cert creation done (still need to bundle to pkcs12) and was looking at how best to access barbican as a client. | 01:04 |
| johnsom | bzhao__ As for the host name validation, I was going to override the hostname validation of the "requests" library to have it check for a pre-defined string instead of a hostname. | 01:05 |
| johnsom | bzhao__ Other than the barbican service client issue, I have the rest of the gate setup here: https://review.openstack.org/#/c/628075 It's broken because I was testing a point about requirements, but it is the general idea. | 01:06 |
| bzhao__ | johnsom: ha, I force to load barbican tempest plugin and load the client from the internal os_admin.secret_v1. ;-). Just current proposal, and I think it's not good. | 01:09 |
| johnsom | bzhao__ See this for the host validation: https://github.com/openstack/octavia/blob/master/octavia/amphorae/drivers/haproxy/rest_api_driver.py#L294 | 01:10 |
| johnsom | bzhao__ Yeah, so we are both thinking about how to do this barbican call | 01:10 |
| johnsom | bzhao__ I might just use the python-barbicanclient if I can figure out how to get the right credential out of tempest to use with the barbican client. | 01:12 |
| johnsom | I think I need something out of "cls.os_roles_lb_member" that I can use to authenticate the barbican client. | 01:13 |
| bzhao__ | johnsom: For host name validation, I test with inject the host name into kwargs to request, but it fails if I not change the /etc/hosts https://usercontent.irccloud-cdn.com/file/Z5myYLFP/image.png | 01:13 |
| johnsom | bzhao__ Yeah, we don't necessarily need to inject it into the request, more that we need to override the requests library to validate our string instead of the host and CN. | 01:14 |
| johnsom | This is how we authenticate the amphora certs | 01:15 |
| bzhao__ | johnsom: Correct, I think python-barbicanclient is the right way. And I make a mistake about the host name validation yesterday. ;-) | 01:15 |
| bzhao__ | johnsom: I need to base on your thought to refactor and the current code your proposal. Maybe some changes to https server also. ;-). | 01:17 |
| johnsom | bzhao__ Ok. I think I will continue to work on my patch and we can align the patches once yours is posted. Is that ok? | 01:18 |
| johnsom | It may be a bit of duplicate work, but in the end we can take the best ideas and merge them | 01:19 |
| bzhao__ | johnsom: OK. Thank you for kind suggest. I will split my proposal and post the new https server code first. Yeah, I think there is a duplicate work there. OK, very happy to chat with you. ;-) | 01:20 |
| johnsom | bzhao__ You too | 01:21 |
| bzhao__ | johnsom: I re-think the https://storyboard.openstack.org/#!/story/2004679 bug, this bug hit in octavia-worker process. But https://storyboard.openstack.org/#!/story/2004665 this bug hits in octavia-health-keeping process, and calros's fix seems to evade the issue just for octavia health keeping cases. What the first bug is during I create a member to exist LB resources(including L7 resources), so I think that could | 01:33 |
| bzhao__ | be a bigger problem, and we just see a little part in house keeping side., there may need more fixes, I think. ;-) | 01:33 |
| johnsom | Yes, I agree. The ORM is going off the rails and we need to fix it | 01:37 |
| cgoncalves | ORM is eager loading everything because it's instructed to do so... | 01:42 |
| johnsom | I know we switched it to do that because it was eating up all the connection slots round tripping for everything. | 01:46 |
| johnsom | Personally I don't think we should ever star join anything | 01:47 |
| *** yamamoto has quit IRC | 01:47 | |
| johnsom | But I am also not a fan of many of these ORM layers that make poor choices | 01:47 |
| *** yamamoto has joined #openstack-lbaas | 01:48 | |
| *** yamamoto has quit IRC | 01:53 | |
| *** yamamoto has joined #openstack-lbaas | 02:10 | |
| *** hongbin has joined #openstack-lbaas | 02:15 | |
| *** abaindur has quit IRC | 02:27 | |
| *** abaindur has joined #openstack-lbaas | 02:28 | |
| *** abaindur_ has joined #openstack-lbaas | 02:31 | |
| *** abaindur has quit IRC | 02:33 | |
| *** abaindur_ has quit IRC | 02:38 | |
| *** abaindur has joined #openstack-lbaas | 02:38 | |
| *** abaindur_ has joined #openstack-lbaas | 02:41 | |
| *** abaindur has quit IRC | 02:43 | |
| *** abaindur has joined #openstack-lbaas | 02:43 | |
| *** abaindur_ has quit IRC | 02:46 | |
| *** abaindur_ has joined #openstack-lbaas | 02:46 | |
| *** abaindur has quit IRC | 02:48 | |
| *** abaindur has joined #openstack-lbaas | 02:50 | |
| *** yamamoto has quit IRC | 02:51 | |
| *** yamamoto has joined #openstack-lbaas | 02:52 | |
| *** abaindur_ has quit IRC | 02:53 | |
| *** abaindur has quit IRC | 02:54 | |
| *** abaindur has joined #openstack-lbaas | 02:55 | |
| *** celebdor has quit IRC | 02:55 | |
| *** abaindur has quit IRC | 03:03 | |
| *** psachin has joined #openstack-lbaas | 03:04 | |
| *** psachin has quit IRC | 03:07 | |
| *** psachin has joined #openstack-lbaas | 03:08 | |
| *** yamamoto has quit IRC | 03:24 | |
| *** hongbin has quit IRC | 03:26 | |
| *** sapd1 has joined #openstack-lbaas | 03:37 | |
| *** hongbin has joined #openstack-lbaas | 04:01 | |
| *** sapd1_ has quit IRC | 04:12 | |
| *** sapd1__ has joined #openstack-lbaas | 04:12 | |
| *** ramishra has joined #openstack-lbaas | 04:18 | |
| *** sapd1_x has joined #openstack-lbaas | 04:31 | |
| *** sapd1 has quit IRC | 04:31 | |
| *** hongbin has quit IRC | 04:52 | |
| *** yamamoto has joined #openstack-lbaas | 05:22 | |
| *** phuoc_ has joined #openstack-lbaas | 05:25 | |
| *** phuoc has quit IRC | 05:27 | |
| *** yamamoto has quit IRC | 06:04 | |
| openstackgerrit | Yang JianFeng proposed openstack/octavia master: Add listener and pool protocol validation https://review.openstack.org/594040 | 06:32 |
| *** yamamoto has joined #openstack-lbaas | 06:42 | |
| *** yangjianfeng has joined #openstack-lbaas | 06:42 | |
| *** yangjianfeng has quit IRC | 06:42 | |
| *** rcernin has quit IRC | 06:47 | |
| *** sapd1_x has quit IRC | 06:57 | |
| *** sapd1_x has joined #openstack-lbaas | 06:58 | |
| *** sapd1__ has quit IRC | 07:41 | |
| *** rpittau has joined #openstack-lbaas | 07:53 | |
| *** abaindur has joined #openstack-lbaas | 07:55 | |
| *** abaindur has quit IRC | 07:55 | |
| *** abaindur has joined #openstack-lbaas | 07:56 | |
| *** yamamoto has quit IRC | 07:58 | |
| *** celebdor has joined #openstack-lbaas | 08:31 | |
| *** gcheresh has joined #openstack-lbaas | 08:50 | |
| *** gcheresh has quit IRC | 08:59 | |
| *** gcheresh has joined #openstack-lbaas | 09:15 | |
| *** abaindur has quit IRC | 09:27 | |
| *** yamamoto has joined #openstack-lbaas | 09:40 | |
| *** celebdor has quit IRC | 09:41 | |
| *** yamamoto has quit IRC | 09:43 | |
| *** sapd1_x has quit IRC | 11:13 | |
| *** rpittau is now known as rpittau|lunch | 11:28 | |
| *** rpittau|lunch has quit IRC | 11:43 | |
| *** rpittau|lunch has joined #openstack-lbaas | 11:44 | |
| jiteka | hey johnsom, while following it I found a small mistake in "Octavia Certificate Configuration Guide" in "Configuring Octavia" section | 11:44 |
| jiteka | https://docs.openstack.org/octavia/latest/admin/guides/certificates.html#configuring-octavia | 11:44 |
| jiteka | # chmod 700 /etc/octavia/certs/client.cert-key.pem | 11:44 |
| jiteka | should be : | 11:44 |
| jiteka | # chmod 700 /etc/octavia/certs/client.cert-and-key.pem | 11:44 |
| *** gcheresh has quit IRC | 11:48 | |
| *** rpittau|lunch has quit IRC | 11:58 | |
| *** rpittau|lunch has joined #openstack-lbaas | 12:01 | |
| *** rpittau|lunch has quit IRC | 12:13 | |
| *** rpittau|lunch has joined #openstack-lbaas | 12:13 | |
| *** rpittau|lunch has quit IRC | 12:28 | |
| *** rpittau has joined #openstack-lbaas | 12:33 | |
| *** gcheresh has joined #openstack-lbaas | 13:30 | |
| *** gcheresh has quit IRC | 13:42 | |
| *** celebdor has joined #openstack-lbaas | 14:01 | |
| *** velizarx has joined #openstack-lbaas | 14:18 | |
| *** gcheresh has joined #openstack-lbaas | 14:24 | |
| *** velizarx has quit IRC | 14:33 | |
| *** velizarx has joined #openstack-lbaas | 15:28 | |
| openstackgerrit | zhulingjie proposed openstack/octavia master: Update hacking version to latest https://review.openstack.org/628509 | 15:59 |
| *** velizarx has quit IRC | 16:11 | |
| *** gcheresh has quit IRC | 16:12 | |
| openstackgerrit | Michael Johnson proposed openstack/octavia master: Fix a typo in the certificates admin guide. https://review.openstack.org/628588 | 16:32 |
| johnsom | jiteka Thanks, ^^^ updated | 16:32 |
| *** psachin has quit IRC | 16:32 | |
| *** gcheresh has joined #openstack-lbaas | 16:32 | |
| *** gcheresh has quit IRC | 16:42 | |
| *** celebdor has quit IRC | 17:00 | |
| *** celebdor has joined #openstack-lbaas | 17:01 | |
| *** ramishra has quit IRC | 17:06 | |
| openstackgerrit | zhulingjie proposed openstack/octavia-tempest-plugin master: Update hacking version to latest https://review.openstack.org/628631 | 17:08 |
| openstackgerrit | zhulingjie proposed openstack/octavia-lib master: Update hacking version to latest https://review.openstack.org/628633 | 17:08 |
| *** rpittau has quit IRC | 17:12 | |
| *** celebdor has quit IRC | 17:12 | |
| openstackgerrit | zhulingjie proposed openstack/neutron-lbaas master: Update hacking version to latest https://review.openstack.org/628646 | 17:48 |
| openstackgerrit | Merged openstack/octavia master: fix typo mistakes https://review.openstack.org/625419 | 18:44 |
| openstackgerrit | Merged openstack/octavia master: Modify the doc word error https://review.openstack.org/623720 | 18:54 |
| *** velizarx has joined #openstack-lbaas | 19:19 | |
| *** velizarx has quit IRC | 19:34 | |
| *** gcheresh has joined #openstack-lbaas | 20:06 | |
| *** abaindur has joined #openstack-lbaas | 20:09 | |
| *** gcheresh has quit IRC | 20:30 | |
| *** gcheresh has joined #openstack-lbaas | 21:05 | |
| *** gcheresh has quit IRC | 21:51 | |
| johnsom | Why oh why is barbican a roach motel | 23:29 |
| johnsom | secrets go in but can't come out.... delete even with admin creds, one line below the create, fails. | 23:30 |
| *** openstack has joined #openstack-lbaas | 23:47 | |
| *** ChanServ sets mode: +o openstack | 23:47 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!
